darkmatteroniontor[.]cc

PhishDestroy analysts flagged darkmatteroniontor.cc as a generic phishing domain currently under investigation due to its active lure targeting unsuspecting users under the seed 3b949d. The domain mimics legitimate onion services, attempting to harvest credentials via a spoofed login portal. No specific drainer kit or branded decoy has been confirmed at this stage, but historical traces suggest generic phishing toolkits are frequently deployed on similar infrastructures.

Technical indicators reveal the domain was registered through Dynadot LLC on September 17, 2025, and resolves to IP 172.67.216.122. Currently, VirusTotal shows zero detections out of 95 engines, and the SSL certificate issued by Google Trust Services suggests an attempt to appear legitimate. As of now, no blocklist entries or Safe Browsing flags have been recorded, leaving this domain in a pre-detection window despite active redirection attempts. This combination of fresh registration, low detection coverage, and deceptive SSL issuance creates a high-risk decoy awaiting widespread compromise.

This domain remains active with a status of ongoing investigation. Immediate defensive actions include adding darkmatteroniontor.cc to blocklists, monitoring DNS resolutions, and alerting end-users to avoid interaction. While risk is under assessment, the low VT score (2/95) and absence of network blocklisting indicate a potential window for exploitation before automated detection matures. Users accessing this domain should treat all inputs as compromised and initiate account recovery procedures if credentials were entered. Remaining risk hinges on the speed of SIEM integration and signature deployment.